[
https://issues.apache.org/jira/browse/CAMEL-26282?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen resolved CAMEL-26282.
---------------------------------
Resolution: Fixed
Fixed on main by https://github.com/apache/camel/pull/29150, and backported to
camel-4.22.x (https://github.com/apache/camel/pull/29169) and camel-4.18.x
(https://github.com/apache/camel/pull/29170). The backports sit on top of the
CAMEL-26118 backports (#29166, #29167), so FlowableProducer is the same on all
three lines.
_Claude Code on behalf of davsclaus_
> camel-flowable - xml inbound channels parse events with the Camel XML settings
> ------------------------------------------------------------------------------
>
> Key: CAMEL-26282
> URL: https://issues.apache.org/jira/browse/CAMEL-26282
> Project: Camel
> Issue Type: Improvement
> Reporter: Claus Ibsen
> Assignee: Claus Ibsen
> Priority: Major
> Fix For: 4.18.6, 4.22.3, 4.24.0
>
>
> When a Flowable event registry inbound channel of type {{camel}} uses
> {{deserializerType: xml}}, the {{flowable:}} producer hands the message body
> to Flowable's {{StringToXmlDocumentDeserializer}}. In Flowable 7.x that class
> builds a {{DocumentBuilderFactory}} with the JDK default settings, unlike the
> XML parsing elsewhere in Camel (for example {{XmlConverter}}) and unlike
> Flowable 8, which configures the factory explicitly. Camel stays on Flowable
> 7.2.0 for now (Flowable 8 needs Jackson 3, see CAMEL-23143).
> h3. Today
> {{FlowableProducer}} passes the body unchanged to
> {{InboundChannelModel.getInboundEventProcessingPipeline()}}, and the xml
> pipeline parses it with the Flowable 7.x deserializer. DOCTYPE declarations,
> external DTDs and XInclude are processed with the JDK defaults.
> h3. After the change
> Inbound camel channels with the xml deserializer parse the event with the
> same settings Camel uses for its own XML parsing (and that Flowable 8 uses):
> secure processing on, external general and parameter entities off, external
> DTD loading off, entity reference expansion off, XInclude off, and
> {{ACCESS_EXTERNAL_DTD}} / {{ACCESS_EXTERNAL_SCHEMA}} set to empty. A channel
> that sets its own {{deserializerDelegateExpression}} keeps its own
> deserializer.
> h3. Code change
> * New
> {{org.apache.camel.component.flowable.CamelStringToXmlDocumentDeserializer}},
> extending Flowable's {{StringToXmlDocumentDeserializer}} and overriding
> {{deserialize}} with a configured {{DocumentBuilderFactory}} (each feature or
> attribute set in a try/catch for parser implementations that do not support
> it). Inline, no new dependency.
> * {{FlowableProducer}}: before {{eventReceived}}, when the channel's pipeline
> is a {{DefaultInboundEventProcessingPipeline}} whose deserializer is exactly
> {{StringToXmlDocumentDeserializer}} (class equality), replace it with the
> Camel deserializer via {{setInboundEventDeserializer}}. Doing it in the
> producer keeps it independent of the order of Flowable's channel model
> processors and also covers redeployed channels.
> * {{flowable-component.adoc}}: a note on how xml inbound channels are parsed
> and that {{deserializerDelegateExpression}} selects a different parser;
> regenerate the catalog doc copy.
> * Upgrade guide notes for 4.24.0, 4.22.3 and 4.18.6: xml events that rely on
> a DOCTYPE with external entities or an external DTD no longer have them
> loaded.
> h3. Tests
> * {{FlowableInboundXmlChannelTest#xmlEventStartsProcessWithMappedVariables}}:
> a new xml channel and event definition; an XML body starts the process with
> the mapped variables (there is no xml channel test today).
> * {{FlowableInboundXmlChannelTest#xmlChannelUsesCamelXmlDeserializer}}: after
> a send, the channel pipeline uses the Camel deserializer.
> * {{FlowableInboundXmlChannelTest#customXmlDeserializerIsKept}}: a channel
> with {{deserializerDelegateExpression}} keeps its own deserializer.
> *
> {{CamelStringToXmlDocumentDeserializerTest#entityDeclaredInDoctypeIsNotExpandedFromFile}}:
> a body whose DOCTYPE declares an entity pointing at a file under {{target/}}
> does not get the file content in the parsed document.
> Related: CAMEL-26118 changes the same producer.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
